{"id":301,"date":"2026-10-28T17:42:53","date_gmt":"2026-10-28T12:12:53","guid":{"rendered":"https:\/\/incepbio.com\/blog\/?p=301"},"modified":"2026-10-28T17:46:07","modified_gmt":"2026-10-28T12:16:07","slug":"brownfield-cqv","status":"publish","type":"post","link":"https:\/\/incepbio.com\/blog\/brownfield-cqv\/","title":{"rendered":"Brownfield CQV: 5 Ways to Reduce GMP Compliance Risks"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n \t\t\t

Brownfield CQV is the commissioning, qualification, and validation work performed when an existing GMP facility, utility, equipment item, or control system is modified, upgraded, or expanded, while the rest of the site retains its established qualified status. The term is industry usage rather than a defined term in EU GMP, so this article uses it as a working definition.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

The central compliance risk in pharmaceutical brownfield projects is that changing one system can alter another's validated state. EU GMP Annex 15 states that planned changes to facilities, equipment, utilities, and processes that may affect product quality should be formally documented and that the impact on the validated status or control strategy should be assessed. The five approaches below turn that expectation into practical engineering controls.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

What Makes Brownfield CQV Different from CQV for a New Facility?<\/strong><\/h2>\n\t\t\n<\/div>\n
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n Short answer:\n<\/span>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n \t\t\t

In a new facility, qualification builds a qualified state from user requirements through performance testing. In a brownfield project, the existing qualified state must be protected while new work is added, so impact assessment, interface testing, and change control carry more weight.<\/p>\n\t\t\n<\/div>\n

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\n
<\/div>\n\n

\n Three practical differences follow:\n <\/h3>\n\n
\n\n \n
\n
\n 01\n <\/div>\n\n

\n Operating History\n <\/h4>\n\n

\n Existing systems have operating history, such as calibration records, trends, and prior deviations, and this history informs the risk assessment.\n <\/p>\n <\/div>\n\n \n

\n
\n 02\n <\/div>\n\n

\n System Interfaces\n <\/h4>\n\n

\n New work often shares air handling, utilities, or control networks with systems in production, so a fault can propagate.\n <\/p>\n <\/div>\n\n \n

\n
\n 03\n <\/div>\n\n

\n Testing Limits\n <\/h4>\n\n

\n Access, shutdown windows, and ongoing manufacturing limit what can be tested and when.\n <\/p>\n <\/div>\n\n <\/div>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tThe general CQV lifecycle is covered in IncepBio’s guide to pharmaceutical CQV<\/a>. This article covers only what changes when the facility already exists.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n \t\t\t

Approach 1: Perform a Documented GMP Change Impact Assessment<\/strong><\/h2>\n\t\t\n<\/div>\n
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\n The problem.<\/strong> Brownfield changes are often scoped by the project rather than by the systems they touch. A new isolator, a relocated wall, or an added utility load can affect systems that never appear in the project scope.\n<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\n The compliance risk.<\/strong> Annex 15, section 11.4, expects quality risk management to be used to evaluate planned changes for their potential impact on product quality, the pharmaceutical quality system, documentation, validation, regulatory status, calibration, maintenance, and other systems. The purpose is to avoid unintended consequences and plan any necessary process validation, verification, or requalification. An assessment limited to the project scope does not meet that intent.\n<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\n The practical response.<\/strong> Start with a system boundary and an interface list, then assess each affected system.\n<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n \t\t\t

What the Assessment Should Examine<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

For each system, ask whether the change alters intended use, operating range, capacity, materials of construction, software or control logic, cleaning or sterilisation methods, or environmental classification. Include utilities, HVAC, calibration and maintenance programmes, SOPs and training. Whether a change affects a marketing authorisation is a separate determination, made with regulatory affairs.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Annex 15, Section 1.7, requires a quality risk management approach for qualification and validation activities. Revisit the assessment when design details or the understanding of potential impacts change.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Evidence Expected<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Expect to hold an approved change record, a documented risk assessment that explains what is in and out of scope, a list of affected qualified systems, and a recorded decision on the verification or requalification required. Each exclusion needs a written rationale.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Planning a Brownfield CQV Project?<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Changes to existing equipment and systems require a documented assessment of their impact on the qualified state. IncepBio's CQV services can support relevant qualification and verification activities.<\/p>\n\t\t\n<\/div>\n

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n
\n\n
\n Discuss Your CQV Requirements\n <\/div>\n\n \n Contact IncepBio →\n <\/a>\n\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n \t\t\t

Approach 2: Use Risk-Based Qualification and Requalification Planning<\/strong><\/h2>\n\t\t\n<\/div>\n
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\n The problem.<\/strong> Teams often default to one of two extremes: repeating full qualification for every change or testing only the new item. Both are hard to justify.\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\n

\n The compliance risk.<\/strong> Annex 15 says the scope and extent of qualification and validation should rest on a justified and documented risk assessment. Over-testing wastes shutdown time. Under-testing, or reducing scope without a written rationale, leaves the qualified state unsupported.\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n \t\t\t

When Is Requalification Needed?<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Requalification is needed when a change or an evaluation of the system's state shows that previously demonstrated performance may no longer be assured. It is not automatic for every modification; the required scope should be justified through a documented risk assessment and applicable site procedures.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Two triggers apply. Annex 15, section 4, expects equipment, facilities, utilities, and systems to be evaluated at an appropriate frequency to confirm they remain in a state of control. Section 11 links the extent of verification or requalification to the outcome of the change risk assessment.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Matching Test Depth to the Change<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Risk-based qualification means test depth follows the nature of the change. The three categories below are illustrative engineering practice, not regulatory classes. Define them in the site's own procedure.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Like-for-Like Replacement<\/strong><\/h4>\n\t\t\n<\/div>\n
\n \t\t\t

A replacement with an identical specification may need a documented comparison with the original, installation verification, calibration, and targeted functional checks, rather than full OQ and PQ, if the risk assessment supports this.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Modification of an Existing System<\/strong><\/h4>\n\t\t\n<\/div>\n
\n \t\t\t

Test the changed function and the functions it can influence. Regression testing, which repeats selected existing tests, confirms unchanged functions still perform. Where a change moves operating limits, challenge the new limits, consistent with Annex 15's expectation that OQ confirms upper and lower operating limits.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

New Equipment on Existing Utilities<\/strong><\/h4>\n\t\t\n<\/div>\n
\n \t\t\t

Qualify the new equipment through its own stages. Separately, assess whether the utility still delivers the required capacity and quality at the new combined load. Annex 15, section 3.6 allows some FAT tests to avoid repetition at IQ\/OQ where justified and where functionality is shown to be unaffected by transport and installation.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Approach 3: Assess Facility, HVAC and Utility Interfaces<\/strong><\/h2>\n\t\t\n<\/div>\n
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\n The problem.<\/strong> Facility and utility systems are shared. Added rooms, equipment, heat load, extraction or process connections can change airflow patterns, pressure cascades, temperature and humidity control, and utility demand in areas outside the project.\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\n The compliance risk.<\/strong> Annex 15, section 8, expects utility quality to be confirmed after installation using the qualification steps in section 3, with the period and extent reflecting intended use and any seasonal variation. It expects a risk assessment where utilities may contact the product directly or indirectly, naming HVAC as an example. For sterile manufacture, Annex 1 (2022) refers to Annex 15 for qualifying cleanrooms and clean air equipment and addresses periodic requalification.\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n \t\t\t

Environmental and Cleanroom Effects<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Assess whether the change affects air change rates, supply and return balance, room pressure differentials, temperature, humidity, room classification, or personnel and material flow.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Relevant verification may include airflow and pressure differential measurements, HEPA filter integrity tests, particle counts for classification, airflow visualisation where critical zones are affected, and a review of environmental monitoring data. Select only tests that address the identified risk. A change confined to an unclassified area does not need cleanroom classification testing. ISO 14644 defines recognised methods for cleanroom classification and testing.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Identified HVAC or cleanroom impacts?<\/strong><\/p>\n\t\t\n<\/div>\n

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\n IncepBio’s cleanroom validation<\/a> and CQV services<\/a> can support relevant verification activities, including HEPA filter integrity testing and particle counting.\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n
\n\n
\n Planning a facility modification?\n <\/div>\n\n \n Talk to IncepBio →\n <\/a>\n\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n \t\t\t

Approach 4: Control Automation and System Changes<\/strong><\/h2>\n\t\t\n<\/div>\n
\n \t\t\t

Not every brownfield project involves automation changes. Where one does, the risk is that a change to logic or configuration affects functions that were previously verified.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

EU GMP Annex 11, Section 4, addresses computerised-system validation, while Section 10 requires changes to computerised systems and configurations to be controlled under a defined procedure. Section 9 addresses risk-based audit trails for GMP-relevant changes and deletions. <\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Where Automation Is in Scope<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Typical triggers are new equipment integrated into an existing PLC\/SCADA or BMS, changes to alarm limits, setpoints, interlocks, or sequence logic, new network connections, additional EMS sensors in a monitored area, and changes to user roles.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Assess each against GMP criticality, whether the function is configured or custom-coded, the effect on data and records, and interaction with existing interlocks.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Evidence Expected for Automation Changes<\/strong><\/h3>\n\t\t\n<\/div>\n
\n \t\t\t

Maintain a controlled record of software and configuration changes. Depending on the change and its documented risk assessment, evidence may include a baseline configuration backup, updated functional specifications, testing of changed functions, regression testing of related functions, and challenge testing of affected alarms and interlocks.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Where relevant, verify backup restoration, review audit trails, and confirm that access controls remain appropriate. For systems exchanging GMP-relevant data, assess the accuracy and security of data transfers. These checks help demonstrate that the modified system continues to operate as intended and that relevant GMP records remain reliable.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

GAMP 5 is industry guidance that supports a risk-based approach to computerised-system validation; it does not replace applicable regulations.<\/p>\n\t\t\n<\/div>\n

\n \t\t\t

Planning an automation change in an existing GMP facility?<\/strong><\/p>\n\t\t\n<\/div>\n

\n \t\t\t

IncepBio supports pharmaceutical automation and computerised system validation to help manage system changes, testing, and GMP documentation.<\/p>\n\t\t\n<\/div>\n

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n
\n\n
\n Discuss Your Automation Requirements\n <\/div>\n\n \n Get in Touch →\n <\/a>\n\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n \t\t\t

Approach 5: Maintain Traceable Documentation and Controlled Handover<\/strong><\/h2>\n\t\t\n<\/div>\n
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\n The problem.<\/strong> Brownfield work involves many parties, including designers, contractors, vendors, validation teams, QA, and operations, and documents change while the site keeps running.\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\n The compliance risk.<\/strong> Annex 15 sets specific documentation expectations:\n<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n
\n\n

\n Key Documentation Requirements\n <\/h3>\n\n